From 961ec128f10f2e9b07992febd263b68b941e8c07 Mon Sep 17 00:00:00 2001
From: Adrian Cowan <othrayte@gmail.com>
Date: Wed, 19 Nov 2025 20:49:05 +1100
Subject: [PATCH] Setup prowlarr

---
 2-nomad-config/prowlarr.nomad.hcl       | 119 ++++++++++++++++++++++++
 2-nomad-config/prowlarr.tf              |  53 +++++++++++
 2-nomad-config/secrets/secrets.enc.json |   7 +-
 2-nomad-config/sonarr.nomad.hcl         |  56 +++++++----
 4 files changed, 215 insertions(+), 20 deletions(-)
 create mode 100644 2-nomad-config/prowlarr.nomad.hcl
 create mode 100644 2-nomad-config/prowlarr.tf

diff --git a/2-nomad-config/prowlarr.nomad.hcl b/2-nomad-config/prowlarr.nomad.hcl
new file mode 100644
index 0000000..15c29c8
--- /dev/null
+++ b/2-nomad-config/prowlarr.nomad.hcl
@@ -0,0 +1,119 @@
+job "prowlarr" {
+  group "prowlarr" {
+    network {
+      mode = "bridge"
+      port "http" {
+        to = 9696
+      }
+    }
+
+    service {
+      connect {
+        sidecar_service {
+          proxy {
+            upstreams {
+              destination_name = "postgres"
+              local_bind_port  = 5432
+            }
+            upstreams {
+              destination_name = "sonarr-api"
+              local_bind_port  = 8989
+            }
+          }
+        }
+      }
+    }
+
+    service {
+      name = "prowlarr"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.prowlarr.middlewares=auth@file",
+      ]
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    service {
+      name         = "prowlarr-api"
+      port         = "http"
+      address_mode = "alloc" # Use allocation IP for Connect as the sidecar can't access the host's published port (hairpin/loopback NAT issue)
+
+      connect {
+        sidecar_service {}
+      }
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    task "prowlarr" {
+      driver = "docker"
+
+      config {
+        image = "lscr.io/linuxserver/prowlarr:latest"
+        ports = ["http"]
+      }
+
+      env {
+        PUID = 1000
+        PGID = 1000
+        TZ   = "Australia/Melbourne"
+
+        # https://wiki.servarr.com/prowlarr/postgres-setup
+
+        # Disable internal auth to use Traefik + Authelia
+        PROWLARR__AUTH__REQUIRED = "Enabled"
+        PROWLARR__AUTH__METHOD   = "External"
+
+        PROWLARR__POSTGRES__USER   = "prowlarr"
+        PROWLARR__POSTGRES__HOST   = "localhost"
+        PROWLARR__POSTGRES__PORT   = "5432"
+        PROWLARR__POSTGRES__MAINDB = "prowlarr-main"
+        PROWLARR__POSTGRES__LOGDB  = "prowlarr-log"
+      }
+
+      volume_mount {
+        volume      = "unraid_appdata_prowlarr"
+        destination = "/config"
+        read_only   = false
+      }
+
+      resources {
+        cpu    = 150
+        memory = 512
+      }
+
+      template {
+        data        = <<EOH
+PROWLARR__POSTGRES__PASSWORD="{{ with nomadVar "nomad/jobs/prowlarr" }}{{ .database_pw }}{{ end }}"
+EOH
+        destination = "secrets/db.env"
+        env         = true # Load the file as environment variables
+      }
+    }
+
+    volume "unraid_appdata_prowlarr" {
+      type            = "csi"
+      read_only       = false
+      source          = "unraid_appdata_prowlarr"
+      access_mode     = "single-node-writer"
+      attachment_mode = "file-system"
+
+      mount_options {
+        mount_flags = ["uid=1000", "gid=1000"]
+      }
+    }
+  }
+}
diff --git a/2-nomad-config/prowlarr.tf b/2-nomad-config/prowlarr.tf
new file mode 100644
index 0000000..6be5eb0
--- /dev/null
+++ b/2-nomad-config/prowlarr.tf
@@ -0,0 +1,53 @@
+resource "nomad_job" "prowlarr" {
+  jobspec = file("prowlarr.nomad.hcl")
+}
+
+resource "nomad_variable" "prowlarr" {
+  path = "nomad/jobs/prowlarr"
+  items = {
+    database_pw = data.sops_file.secrets.data["prowlarr.database_pw"]
+  }
+}
+
+# https://wiki.servarr.com/prowlarr/postgres-setup
+resource "postgresql_role" "prowlarr" {
+  name     = "prowlarr"
+  password = data.sops_file.secrets.data["prowlarr.database_pw"]
+  login    = true
+}
+
+resource "postgresql_database" "prowlarr_main" {
+  name  = "prowlarr-main"
+  owner = postgresql_role.prowlarr.name
+}
+
+resource "postgresql_database" "prowlarr_log" {
+  name  = "prowlarr-log"
+  owner = postgresql_role.prowlarr.name
+}
+
+resource "nomad_csi_volume_registration" "unraid_appdata_prowlarr" {
+  #Note: Before chaning the definition of this volume you need to stop the jobs that are using it
+  depends_on = [data.nomad_plugin.smb]
+  plugin_id  = "smb"
+
+  volume_id = "unraid_appdata_prowlarr"
+  name      = "unraid_appdata_prowlarr"
+
+  external_id = "unraid_appdata_prowlarr"
+
+  capability {
+    access_mode     = "single-node-writer"
+    attachment_mode = "file-system"
+  }
+
+  context = {
+    source = "//betelgeuse-seven-unraid.lan/appdata"
+    subDir = "prowlarr" # Note: Needs to be manually created on the share
+  }
+
+  secrets = {
+    "username" = "nomad"
+    "password" = data.sops_file.secrets.data["unraid.nomad"]
+  }
+}
diff --git a/2-nomad-config/secrets/secrets.enc.json b/2-nomad-config/secrets/secrets.enc.json
index f57f3d2..061b603 100644
--- a/2-nomad-config/secrets/secrets.enc.json
+++ b/2-nomad-config/secrets/secrets.enc.json
@@ -40,6 +40,9 @@
 		"user": "ENC[AES256_GCM,data:kniAs2gCTq4=,iv:1Oaht02fFSQwzWmWEtjsJZCJChPJsZhwRyux8dMY2CU=,tag:NqWaUhuYTSFZZK/CpSisdg==,type:str]",
 		"pass": "ENC[AES256_GCM,data:c8qWGcaI0p7MyQ==,iv:/3ehYrgdDwjzFdXyX/vKTK+zt6u7gWNRZBIdWDG1KiE=,tag:jqfIMnB1OKchBZ4U2s1o4g==,type:str]"
 	},
+	"prowlarr": {
+		"database_pw": "ENC[AES256_GCM,data:FkW5LPoyn8bh0UfWcFq3og==,iv:SFq4Xsdz3FfCDyPjIaAmz5nsC/SPdFrR03GCr3KE/nw=,tag:PVYj7hSWDnfeE7igSXGBSA==,type:str]"
+	},
 	"sops": {
 		"age": [
 			{
@@ -47,8 +50,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUWM4ZDVVbGFrUGdMRHBX\nUFBmU3Nlc0RBSzhFK0tHNHpkQXUvUVdiZUZJCmpRN1lFdENpWW0rcThjVlVQNUl6\nWnlLU0RnQ3FZby81Ly8xTFBrek9nMncKLS0tIFQ4UTRNOC9CRmx4OFJWem1wckZz\nUDFTSzdWZldFK3FqcTNWTWRyNDhHQ2MKS811mR5xn7qiC/aVgPFYJ5c6Q3zxRfcr\nHcvxUvB01vNJKZpRg92vvKPkV6lQO3DXCT98OdfwiymlEOvYxg71Pg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-11-10T12:23:50Z",
-		"mac": "ENC[AES256_GCM,data:vCc3DG0TQrF+mnjX1ZtIzPbZaLQ1DC6MLmcZUTFl2uVkGc4cIImcQMes8U9yU7ftuOAqRWnAwWX2BFrFTq5FLfMH3rmRHgImbD3P0HQpD1Yx6ktnUixNeu/knTmLBD52euzPzc8e5RUIHtlwzWLkEFUYR5pzfPHt7CQ/6J60nhU=,iv:5eXIg5PPP9v5UjXOF/XQga/R7WUTkeFyTGCSKSeZjmE=,tag:zJAcuoFMGt0BcJdSP0tFZQ==,type:str]",
+		"lastmodified": "2025-11-18T12:09:57Z",
+		"mac": "ENC[AES256_GCM,data:zchzaSPjJVbUBzXTrRPGAtQE6xzqxMjTCXRABvwEvgNqLO7i2C/d04hI+pwOuLWyZXiUfqHlGt798ZnP5+MJi249FJmK08l8dAXxKSc+KSc4EfDoF+jWiwmoDEf5SypyHL9RPTeI7zoSJ0IxhtP3zZcD/7Q2PPG7cLDBKHdTJFU=,iv:+UiyEfMtAObZ/vvs2ZaIup9OxxP0uqSmo+h45PrymLk=,tag:f/D8417EGjuOfSdzZtir4Q==,type:str]",
 		"encrypted_regex": "^(.*)$",
 		"version": "3.10.2"
 	}
diff --git a/2-nomad-config/sonarr.nomad.hcl b/2-nomad-config/sonarr.nomad.hcl
index 75374ca..e646a06 100644
--- a/2-nomad-config/sonarr.nomad.hcl
+++ b/2-nomad-config/sonarr.nomad.hcl
@@ -18,11 +18,49 @@ job "sonarr" {
               destination_name = "deluge-api"
               local_bind_port  = 8112
             }
+            upstreams {
+              destination_name = "prowlarr-api"
+              local_bind_port  = 9696
+            }
           }
         }
       }
     }
 
+    service {
+      name = "sonarr"
+      port = "http"
+
+      tags = [
+        "traefik.enable=true",
+        "traefik.http.routers.sonarr.middlewares=auth@file",
+      ]
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
+    service {
+      name         = "sonarr-api"
+      port         = "http"
+      address_mode = "alloc" # Use allocation IP for Connect as the sidecar can't access the host's published port (hairpin/loopback NAT issue)
+
+      connect {
+        sidecar_service {}
+      }
+
+      check {
+        type     = "http"
+        path     = "/"
+        interval = "10s"
+        timeout  = "2s"
+      }
+    }
+
     task "sonarr" {
       driver = "docker"
 
@@ -31,24 +69,6 @@ job "sonarr" {
         ports = ["http"]
       }
 
-      service {
-        name = "sonarr"
-        port = "http"
-
-        tags = [
-          "traefik.enable=true",
-          "traefik.http.routers.sonarr.middlewares=auth@file",
-        ]
-
-        check {
-          name     = "alive"
-          type     = "tcp"
-          port     = "http"
-          interval = "10s"
-          timeout  = "2s"
-        }
-      }
-
       env {
         PUID = 1000
         PGID = 1000